I also didnt really like the way AD provisioning works, so I made a script for that too (provision from AD/block on zimbra accounts blocked on AD, keep attributes synced), I might post it sometime later